United Arab EmiratesDFSA General Module, Cyber Risk Management Framework
DFSA Rulebook, General Module (GEN), Rules 5.5.2 to 5.5.18
archived copy
Read from a public archive copy, not the publisher directly. The publisher does not serve this page to automated readers, so a direct fetch was not an option here; how we access sources. Archived . Publisher's page: https://dfsaen.thomsonreuters.com/entiresection/26146In force.
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security, Governance
As of .
What it requires
- This binds an Authorised Person under the Dubai Financial Services Authority Rulebook in the Dubai International Financial Centre (reached by declaring that you hold a financial-services license).
- Establish and maintain a written Cyber Risk Management Framework approved by your Governing Body, with systems and controls appropriate to the nature, scale and complexity of your activities, and review it periodically and at least annually (Rule 5.5.2).
- Manage Third-Party Cyber Risk as an integral part of your framework (Rule 5.5.3).
- Establish a process for the management of software updates that addresses security vulnerabilities in your ICT Assets and applies updates in a timely manner (Rule 5.5.11).
- Monitor your IT Systems and Networks continuously to detect Cyber Incidents and anomalies, and keep a process for escalating actual or potential Cyber Incidents (Rule 5.5.16).
- Draw up and maintain a written Cyber Incident Response Plan, test its conditions and procedures regularly, and review it at least annually and after a major Cyber Incident (Rule 5.5.17).
- Investigate a detected potential or actual Cyber Incident to determine its nature and extent, and take immediate action to contain it (Rule 5.5.18).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The Dubai Financial Services Authority, which states that firms are required to follow the Cyber Risk Management Rules.
What this law does
The DFSA states that its cyber supervision applies to all DFSA Authorised Firms, Registered Auditors, Credit Rating Agencies and Authorised Market Institutions. The DFSA states that Firms are required to follow the Cyber Risk Management Rules set out in the General Module of the DFSA Rulebook.
Rule 5.5.2 of the DFSA General Module requires an Authorised Person to establish and maintain a Cyber Risk Management Framework to identify, assess and manage Cyber Risk effectively in an integrated and comprehensive manner. Rule 5.5.2 also requires the framework to be in writing and approved by the Governing Body of the Authorised Person. Rule 5.5.2 requires an Authorised Person to review its Cyber Risk Management Framework periodically and at least annually.
Rule 5.5.3 requires an Authorised Person to manage Third-Party Cyber Risk as an integral part of its Cyber Risk Management Framework. Rule 5.5.11 requires an Authorised Person to establish a process for the management of software updates that addresses security vulnerabilities in its ICT Assets. Rule 5.5.16 requires an Authorised Person to monitor its IT Systems and Networks continuously with a view to detecting Cyber Incidents and anomalies.
Rule 5.5.17 requires an Authorised Person to draw up and maintain a robust Cyber Incident Response Plan. Rule 5.5.18 requires an Authorised Person to investigate a detected potential or actual Cyber Incident to determine its nature and extent.
When LexLint raises it
When your app profile says your app provides financial services.